CVE-2026-90794: GPAC MP4Box Use After Free Vulnerability

CVE-2026-90794 Overview

CVE-2026-90794 is a use-after-free vulnerability [CWE-119] in GPAC, an open-source multimedia framework, up to commit f1219cde. The flaw resides in the gf_sg_script_load function within scenegraph/vrml_tools.c, part of the MP4Box component. An attacker can trigger the condition remotely by supplying a crafted scene graph file that manipulates VRML script loading. Public exploit code exists, though the vulnerability requires user interaction to process the malicious media file. The GPAC project addressed the issue in release abi-16.23 through commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24.

Critical Impact
Successful exploitation can lead to memory corruption within MP4Box, enabling denial of service and potential arbitrary code execution when a user processes a malicious multimedia file.

Affected Products

GPAC multimedia framework up to commit f1219cde
GPAC MP4Box command-line utility
GPAC releases prior to abi-16.23

Discovery Timeline

2026-09-14 - CVE-2026-90794 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-90794

Vulnerability Analysis

The vulnerability affects gf_sg_script_load in scenegraph/vrml_tools.c, a function responsible for loading VRML (Virtual Reality Modeling Language) scripts within GPAC's scene graph subsystem. MP4Box invokes this code path when parsing scene descriptions embedded in multimedia containers. The defect allows an object to be freed while a subsequent operation still references the stale pointer, producing a use-after-free condition.

Because MP4Box is frequently used in automated media pipelines and file-conversion workflows, malicious input can reach the vulnerable code without direct user awareness beyond opening the file. The consequence ranges from process crash to memory corruption suitable for further exploitation, though impact metrics on confidentiality, integrity, and availability are limited.

Root Cause

The root cause is improper lifetime management of scene graph node objects during VRML script initialization. Related fixes in the patch also address dangling references in the scene manager loader by explicitly removing nodes from the def_nodes list before unregistering them, preventing subsequent code from dereferencing freed memory.

Attack Vector

An attacker crafts a malicious multimedia file containing a manipulated VRML scene script. The victim must open or process the file with a vulnerable MP4Box build. Exploitation is remote in the sense that the file can be delivered via web download, email, or an automated ingestion pipeline, but user interaction is required to trigger parsing.

// Patch excerpt: src/scene_manager/loader_bt.c
// Source: https://github.com/gpac/gpac/commit/9eb40df4448b88d6a6ce3454657c06f47eff0b24
 	return node;
 
 err:
+	gf_list_del_item(parser->def_nodes, node);
 	gf_node_unregister(node, parent);
 	if (name) gf_free(name);
 	return NULL;

The added gf_list_del_item call removes the node from the tracking list before it is unregistered and freed, eliminating a stale reference that could later be dereferenced. A second patch hunk in src/laser/lsr_dec.c corrects a related declaration-after-label issue in SVG_ViewBox_datatype handling. See the GitHub Commit 9eb40df for the full change set.

Detection Methods for CVE-2026-90794

Indicators of Compromise

Unexpected crashes or segmentation faults in MP4Box processes during scene graph or VRML parsing.
Creation of core dumps referencing gf_sg_script_load or vrml_tools.c stack frames.
Ingestion of multimedia files containing atypical or malformed VRML script nodes.

Detection Strategies

Inventory GPAC installations and compare installed versions against the fixed abi-16.23 release.
Instrument file-processing pipelines with AddressSanitizer or Valgrind in test environments to surface use-after-free triggers.
Monitor for MP4Box invocations processing untrusted input from web uploads, email attachments, or shared drives.

Monitoring Recommendations

Log all MP4Box command executions with input file paths and exit codes for anomaly review.
Alert on repeated MP4Box process crashes originating from the same source directory or user.
Correlate multimedia file downloads with subsequent process abnormalities on the same host.

How to Mitigate CVE-2026-90794

Immediate Actions Required

Upgrade GPAC to release abi-16.23 or later on all systems running MP4Box.
Audit build systems, media servers, and developer workstations for embedded GPAC binaries.
Restrict MP4Box execution to trusted input sources until patching is complete.

Patch Information

The upstream fix is commit 9eb40df4448b88d6a6ce3454657c06f47eff0b24, released in GitHub Release abi-16.23. Additional context is available in GitHub Issue #3799 and the GitHub CVE-Submit Documentation. Downstream Linux distribution packages should be rebuilt against the patched source tree.

Workarounds

Avoid processing untrusted multimedia files with vulnerable MP4Box builds.
Execute MP4Box inside sandboxed environments such as containers, seccomp profiles, or dedicated low-privilege user accounts.
Disable automated media conversion workflows accepting external input until the patched release is deployed.

bash

# Verify installed GPAC version and upgrade from source
MP4Box -version
git clone https://github.com/gpac/gpac.git
cd gpac
git checkout abi-16.23
./configure && make && sudo make install
MP4Box -version